Decide in advance how much damage one wrong decision, repeated, could do, and cap it. Limit the records the agent can reach per task, the value and number of actions per hour and per day, and the share of customers a change reaches first. Add a breaker that stops the capability when patterns look wrong. The aim is that every mistake stays small.
Why do agents need blast-radius limits as well as approval limits?
An approval limit stops one large action. Blast radius is about many small ones. An agent that misreads a rule will apply the misreading to every case that matches, at machine speed, until someone notices. Each action may be well under any limit. Together they can reach thousands of customers before lunch.
People make mistakes one at a time. Agents make them in batches. Controls have to assume that.
Which dimensions should you cap?
| Dimension | Cap | Example |
|---|---|---|
| Records per task | The agent sees only the records related to the task | One customer's account per conversation |
| Actions per period | A rate per minute, hour and day | No more than 200 address updates an hour |
| Value per period | Cumulative totals, per counterparty and overall | Refunds capped at 5,000 a day across all customers |
| Population on change | New behaviour reaches a small segment first | A new brief applies to one region for a week |
| Irreversibility | Hard-to-undo actions held or withheld | Account closures always held |
| Reach across agents | One agent cannot hand work to another to escape a cap | Caps counted across the chain |
Rate limits are easiest to enforce at the interface the agent uses to reach systems; our guide on rate-limiting an AI agent at the API gateway covers the mechanics. Caps that apply across agents matter because otherwise work is simply split; see how to stop agents from passing work around a limit.
What are the practical steps?
- List each capability's worst repeated error. For example: "sends the wrong arrears letter to every customer in a segment."
- Estimate its reach at full speed for a day if nobody noticed.
- Set caps so that reach is tolerable, using the dimensions above.
- Add breakers. If refusals, complaints or reversals jump, or an action's rate spikes, the capability drops to drafting automatically and the owner is alerted.
- Roll out changes in stages. A new brief, model or limit reaches a small population first, with a comparison against the rest.
- Prefer reversible actions. Where two designs achieve the same result, choose the one that can be undone.
- Rehearse. Run a drill: the breaker trips, the owner is paged, the capability stops, and people take over.
What does the agent do, and what stays with a person?
The agent works within the caps and cannot change them. When a breaker trips, it stops proposing that action and continues other work. A person decides whether to restart, after looking at what caused the trip. The owner sets the caps and reviews them at each certificate renewal.
A worked example
Take an energy supplier's billing agent that updates direct debit amounts after meter readings. A change to how it reads smart meter data introduces an error that doubles some estimates.
Because changes roll out in stages, the new logic applies first to one region. The agent is capped at 300 direct debit changes an hour. Within the first hour, complaints from that region rise and the share of changes being reversed jumps. The breaker trips at 180 changes, dropping the capability to drafting and paging the billing manager. One hundred and eighty customers need corrections and an apology. Without the caps and stages, the same error would have reached every smart meter customer by the evening run.
Which controls make the answer hold?
- Caps enforced at the moment of action, counting across agents and sessions.
- Breakers on outcome signals, not only on volume.
- Staged rollout for any change to brief, model, sources or limits.
- Hard-to-undo actions held, regardless of volume.
- Every trip recorded, with what triggered it and who restarted the capability.
The topic guide, agent governance is a bound, not a model, explains why these caps belong outside the agent.
Where Pryme fits
In Pryme, your own limits include rates and cumulative totals checked at the moment of action, alongside role scope, certificate, sources and platform guardrails. A certification run that clears no depth drops the agent to depth 1 the same day, which caps blast radius when evidence weakens.
Questions people ask
Do caps make the agent slower?
Only at the edges. Set them above normal peak volume, so routine work runs freely and only abnormal patterns hit the cap.
Should breakers stop the whole agent?
Usually only the capability involved. Stopping everything adds disruption without reducing the specific risk.
How do we set caps for a new agent with no history?
Start with the team's own volumes before the agent arrived, and set caps at or below them. Raise them as evidence builds.